mirror of
https://github.com/microsoft/regorus.git
synced 2026-08-05 02:16:11 +00:00
8f740e2f6f
Extend the Azure Policy parser to handle complete policyRule and
policyDefinition JSON structures, not just standalone constraints.
Policy rule parser (policy_rule.rs):
- Parse top-level { "if": ..., "then": ... } objects
- Extract effect kind (deny, audit, append, modify, etc.) into typed AST
- Parse "details" structurally when it is an object to pull out
existenceCondition as a first-class Constraint; fall back to opaque
JSON for non-object details (e.g. append array form)
- Detect duplicate/missing keys for "if", "then", "effect", "details"
Policy definition parser (policy_definition.rs):
- Handle both wrapped ARM envelope ({ "properties": { ... } }) and
unwrapped (properties-level keys at top level) forms
- Type-extract displayName, description, mode, metadata, parameters,
and policyRule; everything else goes into extra
- Parse parameter definitions with type, defaultValue, allowedValues,
and metadata; detect duplicate parameter names
- Duplicate key detection throughout
Grammar documentation (docs/azure-policy/azurepolicy.ebnf):
- Add formal EBNF grammar covering policy-rule, then-block,
constraints, conditions, all 19 operators, count expressions,
JSON values, and ARM template expressions
Test harness changes:
- Add parse_level field to YAML test cases: "constraint" (default),
"policy_rule", or "policy_definition"
- Un-skip three parse_errors cases that needed policy_rule-level parsing
- Add policy_rule.yaml with 12 cases covering all 9 effect kinds,
existenceCondition, parameterized effects, complex conditions, and
extra key handling
- Add policy_definition.yaml with wrapped, unwrapped, parameterized,
missing-policyRule, and duplicate-key error cases
226 lines
5.4 KiB
YAML
226 lines
5.4 KiB
YAML
# Copyright (c) Microsoft Corporation.
|
|
# Licensed under the MIT License.
|
|
|
|
# Policy Rule Test Suite
|
|
# Tests that complete policyRule objects (with "if" and "then") parse correctly.
|
|
|
|
cases:
|
|
# =========================================================================
|
|
# Basic policy rules
|
|
# =========================================================================
|
|
|
|
- note: simple_deny
|
|
parse_level: policy_rule
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"field": "type",
|
|
"equals": "Microsoft.Compute/virtualMachines"
|
|
},
|
|
"then": {
|
|
"effect": "deny"
|
|
}
|
|
}
|
|
|
|
- note: audit_effect
|
|
parse_level: policy_rule
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"field": "location",
|
|
"notIn": ["eastus", "westus"]
|
|
},
|
|
"then": {
|
|
"effect": "audit"
|
|
}
|
|
}
|
|
|
|
- note: disabled_effect
|
|
parse_level: policy_rule
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"field": "type",
|
|
"equals": "Microsoft.Storage/storageAccounts"
|
|
},
|
|
"then": {
|
|
"effect": "disabled"
|
|
}
|
|
}
|
|
|
|
# =========================================================================
|
|
# Effects with details
|
|
# =========================================================================
|
|
|
|
- note: append_effect
|
|
parse_level: policy_rule
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"field": "type",
|
|
"equals": "Microsoft.Storage/storageAccounts"
|
|
},
|
|
"then": {
|
|
"effect": "Append",
|
|
"details": [
|
|
{
|
|
"field": "Microsoft.Storage/storageAccounts/networkAcls.defaultAction",
|
|
"value": "Deny"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
|
|
- note: modify_effect
|
|
parse_level: policy_rule
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"field": "type",
|
|
"equals": "Microsoft.Compute/virtualMachines"
|
|
},
|
|
"then": {
|
|
"effect": "Modify",
|
|
"details": {
|
|
"roleDefinitionIds": [
|
|
"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
|
|
],
|
|
"operations": [
|
|
{
|
|
"operation": "addOrReplace",
|
|
"field": "tags.environment",
|
|
"value": "production"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
}
|
|
|
|
- note: deny_action_effect
|
|
parse_level: policy_rule
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"field": "type",
|
|
"equals": "Microsoft.Sql/servers/databases"
|
|
},
|
|
"then": {
|
|
"effect": "DenyAction",
|
|
"details": {
|
|
"actionNames": ["delete"]
|
|
}
|
|
}
|
|
}
|
|
|
|
- note: manual_effect
|
|
parse_level: policy_rule
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"field": "type",
|
|
"equals": "Microsoft.Resources/subscriptions"
|
|
},
|
|
"then": {
|
|
"effect": "Manual",
|
|
"details": {
|
|
"defaultState": "Unknown"
|
|
}
|
|
}
|
|
}
|
|
|
|
- note: deploy_if_not_exists
|
|
parse_level: policy_rule
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"field": "type",
|
|
"equals": "Microsoft.Compute/virtualMachines"
|
|
},
|
|
"then": {
|
|
"effect": "DeployIfNotExists",
|
|
"details": {
|
|
"type": "Microsoft.Compute/virtualMachines/extensions",
|
|
"existenceCondition": {
|
|
"field": "Microsoft.Compute/virtualMachines/extensions/type",
|
|
"equals": "MicrosoftMonitoringAgent"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
- note: audit_if_not_exists
|
|
parse_level: policy_rule
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"field": "type",
|
|
"equals": "Microsoft.Sql/servers"
|
|
},
|
|
"then": {
|
|
"effect": "AuditIfNotExists",
|
|
"details": {
|
|
"type": "Microsoft.Sql/servers/auditingSettings",
|
|
"existenceCondition": {
|
|
"field": "Microsoft.Sql/servers/auditingSettings/state",
|
|
"equals": "Enabled"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
# =========================================================================
|
|
# Parameterized effect
|
|
# =========================================================================
|
|
|
|
- note: parameterized_effect
|
|
parse_level: policy_rule
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"field": "type",
|
|
"equals": "Microsoft.Storage/storageAccounts"
|
|
},
|
|
"then": {
|
|
"effect": "[parameters('effect')]"
|
|
}
|
|
}
|
|
|
|
# =========================================================================
|
|
# Complex conditions with then
|
|
# =========================================================================
|
|
|
|
- note: allof_condition_with_then
|
|
parse_level: policy_rule
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{
|
|
"field": "type",
|
|
"equals": "Microsoft.Compute/virtualMachines"
|
|
},
|
|
{
|
|
"field": "location",
|
|
"equals": "eastus"
|
|
}
|
|
]
|
|
},
|
|
"then": {
|
|
"effect": "deny"
|
|
}
|
|
}
|
|
|
|
- note: unknown_extra_keys_ignored
|
|
parse_level: policy_rule
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"field": "type",
|
|
"equals": "Microsoft.Compute/virtualMachines"
|
|
},
|
|
"then": {
|
|
"effect": "deny"
|
|
},
|
|
"extraKey": "ignored"
|
|
}
|